Application No.: 09/895,532 

Amendment dated June 28, 2005 

Reply to Office Action of March 28, 2005 

This listing of claims will replace all prior versions, and listings, of claims in the application: 
Listing of Claims: 

Claim 1 (currently amended): A method suitable for use in a communication device for 
determining the disposition of incoming e-mail from a sender, said method comprising the steps 
of: 

establishing the identity of the sender to provide a sender identifier; 

determining a cumulative penalty count value associated with said sender 

identifie r, wherein determining said cumulative penalty count value comprises 

assessing a penalty count value to said sender identifier for an undesirable 

activity performed by the sender ; 
retrieving a system overall resource usage status associated with the 

communication device; and 
processing the incoming e-mail on the basis of said cumulative penalty count 

value and said system overall resource usage status. 

Claim 2 (original): The method of claim 1 wherein said step of establishing the identity 
of the sender comprises the step of ascertaining an IP address for the sender. 

Claim 3 (original): The method of claim 1 wherein said step of establishing the identity 
of the sender comprises the step of associating the sender with a peer IP address of the sender 
TCP connection. 

Claim 4 (cancelled) 

Claim 5 (currently amended): The method of claim[[ ]]__! wherein said cumulative 
penalty count value comprises an activity penalty count charged to the sender for current 
undesirable sender activity and a time-dependent penalty count determined from previous 
undesirable sender activity. 
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Claim 6 (original): The method of claim 5 wherein said time-dependent penalty count 
comprises a zero value subsequent to a pre-established retention period. 

Claim 7 (currently amended): The method of claim 5 wherein said time-dependent 
penalty count comprises a prior activity penalty count value reduced by a time-dependent decay 
factor. 

Claim 8 (currently amended): The method of claim[[ ]]JL wherein said undesirable 
activity comprises a member of the group consisting of: sending a large number of e-mails, 
sending emails of relatively large sizes, using a relatively large amount of TCP connection time, 
and causing a TCP timeout. 

Claim 9 (currently amended): The method of claim 1 wherein said system overall 
resource usage status is a function of a member of the group consisting of: the number of 
concurrent TCP connections being maintained, the number of e-mail files in an incoming 
message queue, and the amount of disk space being utilized for an incoming message queue. 

Claim 10 (currently amended): The method of claim 1 wherein said step of processing 
the incoming e-mail comprises the step of assigning an operating state to the communication 
device, said operating state being a function of said system overall resource usage status. 

Claim 1 1 (original): The method of claim 10 wherein said operating state is a member of 
the group consisting of: a normal operating state, a selective-rejection operating sate, and a 
random-rejection operating state. 

Claim 12 (original): The method of claim 11 wherein, for said selective-rejection state, if 
said cumulative penalty count value has a zero value, said step of processing the incoming e-mail 
comprises the step of accepting the incoming e-mail. 
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Claim 13 (original): The method of claim 11 wherein, for said selective-rejection state, if 
said cumulative penalty count value has a nonzero value, said step of processing the incoming e- 
mail comprises the steps of: 

specifying a rejection factor; 

generating a random number; and 

randomly rejecting the incoming e-mail on the basis of said rejection factor and 
said random number. 

Claim 14 (original): The method of claim 13 wherein said step of randomly rejecting 
comprises the step of accepting the incoming e-mail if said random number is greater than said 
rejection factor and rejecting the incoming e-mail if said random number is not greater than said 
rejection factor. 

Claim 15 (currently amended): The method of claim 13 wherein said rejection factor is 
increased if said system overall resource usage status increases and said rejection factor is 
decreased if said system overall resource usage status decreases. 

Claim 16 (original): The method of claim 1 1 wherein, for said random-rejection state, if 
said cumulative penalty count value has a nonzero value, said step of processing the incoming e- 
mail comprises the step of rejecting the incoming e-mail. 

Claim 17 (currently amended): The method of claim 11 wherein, for said random- 
rejection state, if said cumulative penalty count value has a zero value, said step of processing 
the incoming e-mail comprises the steps of: 

deriving a n overall resource usage factor; 

generating a random number; and 

randomly rejecting the incoming e-mail on the basis of said overall resource usage 
factor, said random number, and said cumulative penalty count value. 
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Claim 18 (currently amended): The method of claim 17 wherein said step of randomly 
rejecting comprises the step of accepting the incoming e-mail if said random number is greater 
than a product of said overall resource usage factor and said cumulative penalty count value, and 
rejecting the incoming e-mail if said random number is not greater than said product of said 
overall resource usage factor and said cumulative penalty count value. 

Claim 19 (currently amended): The method of claim 18 wherein said overall resource 
usage factor is increased if a_system overall resource usage status increases and said resource 
usage factor is decreased if said system overall r esource usage status decreases. 

Claim 20 (currently amended): A communication device for determining the disposition 
of incoming e-mail from a sender, said device comprising: 
a penalty count filter module having 

means for identifying the sender; 

means for assigning a penalty count to the sender, said penalty count being 

a function of undesirable activity associated with the sender; 
means for determining an overall resource usage value for said 

communication device in receiving e-mail; 
means for specifying an operating state for penalty count filter module, 

said operating state being a function of said overall resource usage 

value; and 

an accept/reject filter for disposing of the incoming e-mail on the basis of 
said sender penalty count and said operating state. 

Claim 21 (original): The device of claim 20 wherein said means for identifying the 
sender includes means for obtaining at least one of a Domain Name Service verification and a 
peer IP address of the sender TCP connection. 
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Claim 22 (original): The device of claim 20 wherein said undesirable activity comprises 
a member of the group consisting of: sending a large number of e-mails, sending e-mails of 
relatively large sizes, using a relatively large amount of TCP connection time, and causing a TCP 
timeout. 

Claim 23 (currently amended): The device of claim 20 wherein said overall resource 
usage value is a function of a member of the group consisting of: the number of concurrent TCP 
connections being maintained, the number of e-mail files in an incoming message queue, and the 
amount of disk space being utilized for an incoming message queue. 

Claim 24 (currently amended): A communication device for determining the disposition 
of incoming e-mail from a sender, said device comprising: 

a sender penalty count data structure for storing a current penalty count value 

associated with the sender; 
a system resource usage status file for storing a current usage status value for 

device e-mail processing resources; and 
an accept/reject filter for disposing of the incoming e-mail on the basis of said 
penalty count value and said usage status. 

Claim 25 (original): The device of claim 24 wherein said sender penalty count data 
structure includes an entry comprising a member of the group consisting of: a sender 
identification value, a cumulative penalty count value, a cumulative e-mail count, a total e-mail 
size, a total TCP connection time, and a timestamp value. 
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Claim 26 (currently amended): A method suitable for use in a communication device for 
determining the disposition of incoming e-mail from a sender, said method comprising the steps 
of: 

identifying the e-mail sender by determining a sender IP address; 

obtaining a previous sender penalty count value calculated for said sender IP 

address , wherein said previous sender penalty count value is based on 

undesirable activity performed by the sender ; and 
accepting or rejecting the incoming e-mail based on said previous sender penalty 

count value. 

Claim 27 (original): The method of claim 26 further comprising the steps of: 
maintaining a behavior trace table entry for the e-mail sender; and 
determining said previous sender penalty count from said behavior trace table. 

Claim 28 (original): The method of claim 27 further comprising the step of updating 
sender behavior values in said trace table entry in response to receipt of a sender e-mail. 

Claim 29 (currently amended): The method of claim 28 wherein said sender behavior 
values include a member of the group consisting of: the number of e-mails, the total size of e- 
mails, and the total TCP connection time. 

Claim 30 (currently amended): The method of claim 28 wherein said step of updating 
sender behavior values comprises the steps of: 

reducing said behavior trace table value by a time-dependent decay factor; and 
adding a current behavior trace table value to said corresponding reduced 
behavior trace table value. 

Claim 31 (currently amended): The method of claim 30 wherein said time-dependent 
decay factor is a function of the time interval between the last two updates of said behavior trace 
table entry and a pre-established retention period. 
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Claim 32 (currently amended): The method of claim 26 , wherein said previous sender 
penalty count value is determined from undesirable sender activity occurring over a pre- 
established retention period. 

Claim 33 (original): The method of claim 32 wherein said undesirable activity comprises 
a member of the group consisting of: sending a large number of e-mails, sending e-mails of 
relatively large sizes, using a relatively large amount of TCP connection time, and causing a TCP 
timeout. 

Claim 34 (currently amended): The method of claim 26 further comprising the step of 
updating said previous sender penalty count value. 

Claim 35 (currently amended): The method of claim 34 wherein said step of updating 
said previous sender penalty count value comprises the steps of: 

reducing said previous sender penalty count value by a decay factor to yield a 
reduced sender penalty count value, said decay factor being a function of a 
pre-established retention period; and 
adding an activity penalty count value to said reduced sender penalty count value 
to yield an updated sender penalty count value, said activity penalty count 
value calculated as a function of current sender e-mail activities. 

Claim 36 (currently amended): The method of claim 35 wherein said decay factor is 
further a function of the time interval between calculation of said previous sender penalty count 
value and calculation of said activity penalty count value. 
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Claim 37 (currently amended): A method for a communication device for determining 
the disposition of incoming e-mail from a sender, said method comprising steps of: 
establishing an identity of the sender; 

determining a cumulative p enalty count value associated with said identity, 

wherein said cumulative penalty count value is based on undesirable activity 

performed by the sender; 
retrieving a system overall resource usage status associated with the 

communication device; and 
processing the incoming e-mail based on the cumulative p enalty count value and 

the system overall resource usage status. 

Claim 38 (previously presented): The method of claim 37, wherein said step of 
establishing the identity of the sender comprises the step of ascertaining an IP address of the 
sender. 

Claim 39 (canceled) 

Claim 40 (currently amended): The method of claim 37, wherein said cumulative penalty 
count value comprises a prior penalty count value reduced by a time-dependent decay factor. 

Claim 41 (currently amended): The method of claim 37 wherein said step of processing 
the incoming e-mail comprises the step of assigning an operating state to the communication 
device, said operating state being a function of said system overall resource usage status. 

Claim 42 (previously presented): The method of claim 41 wherein said operating state is 
a member of the group consisting of: a normal operating state, a selective-rejection operating 
sate, and a random-rejection operating state. 
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Claim 43 (previously presented): The method of claim 41, wherein said operating state 
comprises a selective-rejection state, and wherein if said cumulative penalty count value has a 
zero value, said step of processing the incoming e-mail comprises the step of accepting the 
incoming e-mail. 

Claim 44 (previously presented): The method of claim 41 wherein said operating state 
comprises a selective-rejection state, and wherein if said cumulative penalty count value has a 
nonzero value, said step of processing the incoming e-mail comprises the steps of: 

specifying a rejection factor; 

generating a random number; and 

randomly rejecting the incoming e-mail on the basis of said rejection factor and 
said random number. 

Claim 45 (previously presented): The method of claim 44 wherein said step of randomly 
rejecting comprises the step of accepting the incoming e-mail if said random number is greater 
than said rejection factor and rejecting the incoming e-mail if said random number is not greater 
than said rejection factor. 

Claim 46 (currently amended): The method of claim 44 wherein said rejection factor is 
increased if said system overall resource usage status increases and said rejection factor is 
decreased if said system overall resource usage status decreases. 

Claim 47 (previously presented): The method of claim 41 wherein said operating state 
comprises a random-rejection state, and wherein if said cumulative penalty count value has a 
nonzero value, said step of processing the incoming e-mail comprises the step of rejecting the 
incoming e-mail. 
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Claim 48 (currently amended): The method of claim 41 wherein said operating state 
comprises a random-rejection state, and wherein if said cumulative penalty count value has a 
zero value, said step of processing the incoming e-mail comprises the steps of: 

deriving a resource usage factor; 

generating a random number; and 

randomly rejecting the incoming e-mail on the basis of said resource usage factor, 
said random number, and said cumulative penalty count value. 

Claim 49 (previously presented): The method of claim 48 wherein said step of randomly 
rejecting comprises the step of accepting the incoming e-mail if said random number is greater 
than a product of said resource usage factor and said cumulative penalty count value, and 
rejecting the incoming e-mail if said random number is not greater than said product of said 
resource usage factor and said cumulative penalty count value. 

Claim 50 (previously presented): The method of claim 49 wherein said resource usage 
factor is increased if said system overall resource usage status increases and said resource usage 
factor is decreased if said system o verall resource usage status decreases. 
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